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The blind quantum computing protocols (BQC) enable a classical client with limited quantum 
technology to delegate a computation to the quantum server(s) in such a way that the privacy of 
the computation is preserved. Here we present a new scheme for BQC that uses the concept of 
the measurement based quantum computing with the novel resource state of Affleck-Kennedy-Lieb- 
Tasaki (AKLT) chains leading to more robust computation. AKLT states are physically motivated 
resource as they are gapped ground states of a physically natural Hamiltonian in condensed matter 
physics. Our BQC protocol can enjoy the advantages of AKLT resource states, such as the cooling 
preparation of the resource state, the energy-gap protection of the quantum computation, and the 
simple and efficient preparation of the resource state in linear optics with biphotons. 
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I. INTRODUCTION 



In a future, at the time when a scalable quantum computer is realized, there will be much demand for the blind 
quantum computation since the quantum computer must be super-expensive and super- fragile, and therefore 

only limited number of servers can possess it. In particular, it is likely that a client (Alice) who has only a classical 
\^ ' computer or a primitive quantum instrument which is not sufficient for the universal quantum computation will ask 
QO ! a quantum server (Bob) to perform her quantum computation on his fully-fledged quantum computer. Bob runs his 
■"sj - 1 quantum computer according to Alice's input and instructions, and finally returns the final output of the quantum 
computation to Alice. The crucial point in the blind quantum computation is that Alice does not want Bob to learn 
. her input, the algorithm she wants to run, and the final output of the computation. For example, if Alice wants to 
factor a large integer by using Shor's factoring algorithm Q, the blind quantum computation must be performed in 
such a way that Bob cannot know her input (the large integer) , the output of the computation (a prime factor) , and 
T ~ ' ■ even the fact that he is factoring. 

For the classical computation, Feigenbaum introduced the notion of "computing with encrypted data" , and 
showed that for some functions /, an instance x can be efficiently encrypted into z = Ek(x) in such a way that Alice 
can recover f(x) efficiently from k and f(z) computed by Bob. Moreover Abadi, Feigenbaum and Killian showed 
that no NP-hard function [?J can be computed blindly if unconditional security is required, unless the polynomial 
hierarchy collapses at the third level @- Even restricting the security condition to be only computational [39j . the 
question of the possibility of blind computing, also known as fully homomorphic encryption, remined open for 30 
years @. 

Unlike classical computing, quantum mechanics could overcome the limitation of computational security. An 
example of the blind quantum computation was first proposed by Childs [l[ where the quantum circuit model is 
adopted, and the register state is encrypted with quantum one-time pad scheme (lOj so that Bob who performs 
quantum gates learns nothing about information in the quantum register. In this method, however, Alice needs to 
have a quantum memory and the ability to apply local Pauli operators at each step. Similarly the protocol proposed 
by Arrighi and Salvail [2| requires multi-qubit preparations and measurements while Aharonov, Ben-Or and Eban's 
protocol [i[ requires a constant-sized quantum computer with memory. 
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On the other hand, in Broadbcnt, Fitzsimons and Kashcfi's protocol [3|], adapted to the one-way quantum com- 
putation [Til [T2I ] all Alice needs is a classical computer and a very weak quantum instrument, which emits random 
singlc-qubit states. In particular, she does not require any quantum memory and the protocol is unconditionally 
secure. In their scheme, Alice's quantum instrument emits states -4= (|0) + e^|l)), where 



is a random number which is secret to Bob, and each state is directly sent to Bob. Bob keeps all these states 
in his quantum memory, and creates the spacial resource state, which is alike to the two-dimensional cluster state 
and called "the brickwork state" 0], by applying the controlled-Z (CZ) operation among appropriate qubits in the 
received states. Alice calculates, by using her classical computer, the direction in which a qubit should be measured, 
and instructs the direction to Bob after some modifications such that (i) the byproduct operators emerged from the 
previous Bob's measurements are compensated, (ii) the random £ is canceled, and (iii) the true direction and the 
true measurement outcomes, which reveal Alice's input, algorithm and output, remain secret to Bob. Bob does the 
measurement on the brickwork state according to the instruction from Alice, and sends the measurement result to 
Alice for the next measurement. After repeating such two-way classical communications between Alice and Bob, their 
measurement-based quantum computation is finally finished, and Bob returns the final result (classical or quantum) 
of the computation to Alice. As is shown in 0, Bob learns nothing about Alice's input, the algorithm she wants to 
run, and the final output of the computation. 

In the recent active interaction between condensed matter physics and quantum information science, plenty of novel 
resource states for the measurement- based quantum computation beyond the cluster state have been proposed fl3l - [2"4| . 
These new resource states have several interesting features and advantages over the cluster state. For example, some of 
those resource states are gapped ground states of their parent Hamiltonians, and therefore they can be easily prepared 
by cooling condensed matter systems and the measurement-based quantum computation can be protected from noise 
by the energy gap [l^ - [23j . In particular, Affleck-Kennedy-Lieb-Tasaki (AKLT) states [25| are physically motivated 
important resource states [14| - l22| , since they are gapped ground states of a physically natural Hamiltonian which has 
long been studied in condensed matter physics, and exhibit many novel features, such as the one-dimensional Haldanc 
phase (26j . the diluted antiferromagnetic order detected by the string order parameter [27j . and the effective spin- 1/2 
degree of freedom (edge state) appearing on the boundary of the chain [28| . Furthermore, it was shown recently that 
the preparation of the AKLT resource states is more efficient and simpler than that of the cluster state in linear optics 
with biphotons J29|. 

It is, however, not obvious that these novel resource states also admit blind quantum computation like the cluster 
state. They have drastically different properties compared to the cluster state or graph states in general, such as the 
local purity, the correlation property, and the entanglement property [I3 - [23| . Furthermore, the actual computation 
over these new resources, such as the way of measurements and the way of compensating byproducts, arc also strongly 
different from those over the cluster state fl3 - l23| . 

In this paper, we show for the first time that the ground state measurement-based blind quantum computation is 
possible with AKLT resource states. As we will see later, this is not a straightforward generalization of the blind 
quantum computation on the cluster state, although it borrows the general idea from 0] . Hence a new proof of security 
for the blind quantum computation with AKLT states was also required. As a result, our new protocol can enjoy 
the advantages of the AKLT resource states, namely the easy preparation of the resource state by cooling condensed 
matter systems, the natural protection of the quantum computation by the energy gap, and the simple and efficient 
preparation of the resource state in linear optics with biphotons. 

More precisely, we propose two methods, the single-server protocol and the double-server protocol. In the single- 
server protocol (Fig. [1]), there are two parties, called Alice and Bob. Alice, the client, has a classical computer 
and a quantum instrument which is not sufficient for the universal quantum computation, whereas Bob, the server, 
has a universal quantum computer. Alice's quantum instrument emits random four-qubit states so-called "Dango 
states" each of which is directly sent to Bob through the quantum channel (Fig. Q] (a)), and Bob stores all of them 
in his quantum memory. Each Dango state hides certain random number which is secret to Bob, and these secret 
numbers are used later for the blind quantum computation. From Dango states, Bob creates the resource state, 
which is unitary equivalent to an AKLT state (Fig. Q] (b)). Alice calculates the angle in which a particle should be 
measured by using her classical computer, and sends the angle to Bob through the classical channel. Bob performs 
the measurement according to Alice's information, and returns the result of the measurement to Alice. They repeat 
this two-way classical communication (Fig.[T](c)) until they finish the computation. Bob finally sends the final output 
of the quantum computation to Alice. The whole protocol can be done in such a way that Bob learns nothing about 
Alice's input, output, and algorithm. Recently an efficient scheme for preparation of AKLT state with biphotons was 
proposed in [29( and it seems that our single-server protocol can be adapted to such a scheme but we leave it as an 
open question what the best implementation is. 
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As we argue later, the single-server protocol cannot enjoy the energy-gap protection in condensed-matter systems, 
since Bob cannot prepare any natural parent Hamiltonian without knowing hidden angles in Dango states. Moreover, 
although Alice's quantum instrument is too primitive to perform the universal quantum computation, and it does 
not seem to be hard to implement this instrument in certain optical setups, it would be ideal if we can make Alice 
completely classical. Therefore, similar to 0] , we consider an extension of the protocol to the double-server protocol. 
In the double-server protocol (Fig. [2]), there are three parties Alice, Bobl, and Bob2. Alice, the client, has only a 
classical computer, whereas Bobl and Bob2, servers, have universal quantum computers. Furthermore, Bobl and 
Bob2 share many Bell pairs but they have no classical or quantum channel between them. In the double-server 
protocol, Bobl first creates AKLT resource states (Fig. [2] (a)). Bobl next adiabatically turns off the interaction 
between some particles and others in his resource state, and teleports these particles to Bob2 by consuming Bell pairs. 
Bobl sends Alice the result of the measurement in the teleportation through the classical channel (Fig. [2] (b)). Note 
that due to the lack of any communication (classical or quantum) channels between Bobl and Bob2, the teleportation 
procedure from Bobs' point of view can be seen as a usage of a totally mixed channel where only Alice knows how 
to correct the output of the channel. Next, Alice calculates the angle in which particles should be measured by 
using her classical computer, and sends Bob2 the angle which is the sum of the calculated angle plus a random angle 
through the classical channel (Fig. [2] (c)). Bob2 performs the measurement in that angle and sends the result of the 
measurement to Alice (Fig. [2] (d)). Alice sends the previous random angle to Bobl (Fig. [2] (e)), and Bobl does the 
single-qubit rotation which compensates that random angle (Fig. [5] (f)). Bobl and Bob2 repeat this two-way classical 
communication with Alice until they finish the computation. The whole protocol can be done in such a way that 
two Bobs learn nothing about Alice's input, output, and algorithm. As we will argue later, the scheme of double 
servers proposed in 0] where Bobl prepares random states and Bob2 performs the measurement that compensates 
that random angle, will not lead to a ground state BQC protocol without affecting the privacy condition. While our 
new protocol can fully benefit from the energy-gap protection in condensed-matter systems, without revealing any 
information about Alice's secret computation. 



(a) (b) 

Alice Bob Alice Bob 




C Comp Dango 



FIG. 1: (Color online.) The single-server protocol, (a): Alice's quantum instrument (QI) emits many four-qubit states so- 
called "Dango" states each of which is directly sent to Bob through the quantum channel (QC). Bob stores all of them in his 
quantum memory, (b): From these Dango states, Bob creates the resource state, (c): Alice calculates the angle in which a 
particle should be measured by using her classical computer (C Comp) and sends the angle to Bob through the classical channel 
(CC). Bob performs the measurement and returns the result of the measurement to Alice. They repeat this two-way classical 
communication until they finish the computation. Bob finally sends the final output of the computation to Alice. 

This paper is organized as follows. In Sec. HH we briefly review the concept of correlation space froT - [l~7l ] which is 
used throughout this paper in order to describe measurement-based quantum computation on AKLT states. We also 
briefly review the AKLT model and measurement-based quantum computing with AKLT resource. In Sec. IIII1 we 
explain the single-server protocol. We show the blindness of the single-server protocol in Sec. IIV1 We also explain the 
double-server protocol in Sec. IVland show its blindness in SeclVH We finish with a discussion in Sec. IVIII which also 
highlights open problems. 
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FIG. 2: (Color online.) The double-server protocol, (a): Bobl creates AKLT resource states. Bobl and Bob2 share Bell 
pairs (BPs). (b): Bobl adiabatically turns off the interaction between some particles and others in his resource state, and 
teleports these isolated particles to Bob2 by consuming Bell pairs. Bobl also sends Alice the result of the measurement in the 
teleportation. (c): Alice calculates the angle in which particles should be measured by using her classical computer (C Comp) 
and sends Bob2 the angle which is the sum of thus calculated angle and a random angle, (d): Bob2 performs the measurement 
in that angle and sends the result of the measurement to Alice, (e): Alice sends Bobl the previous random angle, (f): Bobl 
implements the single-qubit rotation which compensates the random rotation. 



II. QUANTUM COMPUTATION IN CORRELATION SPACE 



In this section, we will briefly review the concept of correlation space [15l4l7| |. which is used throughout this paper. 
For details see Refs. [IMl. 

Let us consider the matrix-product state of a quantum state in the ^-dimensional Hilbert space 

d d 

- J2 {L\A[In]~A[Ii]\R)\In) ® - ® 
i 1= i i N =i 

where \L) and \R) are two-dimensional complex vectors and ^4's are two-dimensional complex matrices. Let us assume 
that the first qudit of the matrix-product state is projected onto 

\6,® = C os 6 -\Q) + e i *sm 6 -\l). 

Then, the matrix-product state becomes 

d d 

- (L\A[l N ]...A[h]A[9 t <f>]\R)\lN) (8) ... <8> \h) 8> \6,4>), 
i 2 =i i N =i 
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where 



A[6, 4>] = cos -A[0] 



'sin -A[l\. 



If A[0] and A[l] are appropriately chosen in such a way that A[0, </>] is unitary, we can "simulate" the unitary rotation 
A\6, 4>]\R) of \R) in the linear space where \L), \R), and ^4's live. This linear space is called "correlation space" 
17] . In t he g eneral framework of measurement-based quantum computation, which is called the computational tensor 
network [15l4l7| . universal quantum computation is performed in this correlation space. Note that in the one-way 
quantum computing model, the correlation space and the physical space are the same. This separation between the 
correlation space and the physical space will allow us to use many new resource states for measurement-based quantum 
computing. One such resource state is the AKLT state fl4j . 

Let us consider the one-dimensional open-boundary chain of N qutrits. The AKLT Hamiltonian plj is defined by 

2V-1 

H AKLT ((3)=J2 

3=1 



where 



and Sj = (SjfSjfSj) is the spin-1 operator on site j defined by 



1 



1 



^2\0 1 0/' 
. / 10 

^[-101 

v2\ -10 




S* = 



If —1 < j3 < 1, the system is in the gapped Haldane phase [26[. In particular, if /3 = —1/3, Each hj+i t j(— 1/3) is 
the projection operator onto the eigenspace of the total spin operator of two spin-1/2 particles corresponding to the 
eigenvalue 2. For j3 = —1/3, the ground states are called AKLT states [25| and explicitly written in the following 
matrix product form [lil |25| : 



\AKLT 



N,L,R\ _ 



V2_ 



J2 - (L\A[lN}-A[h}\R)\lN) ® - (8 |Ii 



(1) 



where 



i 1= i i w =i 



|5 2 



13) = \S, 



S z = 
0), 



\S Z = k) (k 6 { — 1,0, +1}) are eigenvectors of the z-component S z of the spin-1 operator, \L) and \R) are two- 
dimensional complex vectors, and {A[l], A[2], A[3]} are 2x2 matrices defined by 

A[l] = X, 
A[2] = XZ, 
A[3] = Z. 

Here, X and Z are Pauli operators over qubits. Note that the ground states of the AKLT Hamiltonian are four-fold 
degenerate, and each ground state is specified with \L) and \R), which represent two qubit edge states. The AKLT 
states are frustration free, since 

h j+ i,j(-l/3)\AKLT N ' L ' R ) = 



6 



for any \L) and \R), and for all j = 1, N — 1. 

The AKLT model has long been studied in condensed matter physics since it can describe the one-dimensional 
Haldane phase HH of a qutrit chain, which exhibits the spectral gap (2f| , the diluted antiferromagnetic order detected 
by the string order parameter [27j . and the effective spin-1/2 degree of freedom, namely the edge state, appearing on 
the boundary of the chain j28j . Furthermore, the AKLT model has recently been attracting much attentions in the 
field of quantum information, because of its connections to the matrix product representation [30l-f32| , the localizable 
entan glem en t l33l . |3~H , and the measurement-based quantum computation [lH 

ElGIHIt Indeed, it was shown in 

Refs. |14l ll8l42C| that the measurement-based quantum computation is possible on the AKLT chains or other ground 
states in the gapped Haldane phase (—1 < f3 < 1). 

We briefly review universal measurement-based quantum computation on AKLT states [l4| . Assume that a qutrit 
of Eq. JT]) is measured in the basis M.{4>) = {|a(0)), \/3((j>)), where 

H<t>)) = — 11> H 2 — 12>, 

\l) = |3>. 

Then, following operations are implemented in the correlation space according to the measurement result [l4j . 

\a(4>)) : Xe^ z '\ 
: XZe^ 2 ' 2 , 
|7) : Z. 



Now assume that the unitary operation 



K=|3)(l| + |l)(2| + |2)(3| 



is applied on a qutrit and that qutrit is measured in the basis Ai{(f). Then, following operations are implemented in 
the correlation space according to the measurement result [lH ■ 



|a(#) 
1/3(0)) 
|7> 



Ze -i4>x/2^ 
X. 



In this way, any single-qubit Z and X rotations are possible up to some Pauli byproducts. By appropriately 
changing the sign of </> (adapting measurements of the physical qutrits), these byproducts can be moved forward so 
that they are corrected in the final stage of the computation over the correlation space. 



III. SINGLE-SEVER BLIND QUANTUM COMPUTING PROTOCOL 

As said before, in the single-server BQC protocol (Fig.[T|), Alice has a classical computer and a quantum instrument 
that emits random four-qubit states called "Dango states" . Depending on the desired computation and the input size, 
Alice will send (2 x N x M) Dango states directly to Bob through a one-way quantum channel that they initially 
share. Bob stores all of them in his quantum memory to creates the resource state, called "rotated AKLT states". 
The procedure of preparing such an initial state is explained in the Blind state preparation Subsection below. 

Next, Alice calculates the angle in which a particle of a rotated AKLT state should be measured. Recall that 
this is a qutrit measurement that will induce a qubit operation over the correlation space. Moreover the calculated 
angle should compensate for the initial random rotation of the Dango states and byproduct operation of the previous 
measurement. Finally an additional random rotation will be added to hide the true result of the measurement from 
Bob. Bob performs the measurement according to Alice's information (sent via a classical channel to him), and 
returns the result of the measurement to Alice. They repeat this two-way classical communication until they finish 
the computation. Bob finally sends the final output of the quantum computation to Alice. The exact protocol is 
given in the Blind computation Subsection below where we describe how a blind arbitrary X and Z rotation in the 
correlation space can be performed. Next we describe how two-qubit entangling operation of CZ can be performed 
in regular places. The rotation operators are also performed in regular interval, and hence the overall structure of 
the actual underlying computation remains hidden to Bob. These set of operators define a universal set of gates for 
quantum computing. 
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A. Blind state preparation 



(b) 




FIG. 3: (Color online.) (a): A Dango state. Two yellow circles connected by a bond are qubits which consist of the Bell state. 
The operator (7 — |f?i)(?7i|)7z/x(C) a °ts on two qubits in the red dotted circle, (b): A Z-Dango chain for n — 4. (c): A Combo 
chain |C(,). Z-Dango chains are colored in blue, whereas X-Dango chains are colored in green. 



Denote the Bell basis by 

\m) = ^(|0>®|0) + |i>®|i)), 

\ m ) = -L(| )®|o)-|i)®|i)), 

\ m ) = _L(|i) |o) + |o)®|i)), 

\ m ) = -L(|i)®|o)-|o)®|i)). 

The full state preparation is described in Protocol 1. Assume Alice's desired computation is composed of a sequence 
of X and Z-rotations and CZ operations. Depending on the number of the required operators and the size of the 
input, Alice will choose integer values N and M. Then Alice's quantum instrument emits N x M "Z-Dango states" 
and N x M "X-Dango states" defined as (see Fig. [3] (a)) 

|0z(O = (I ® {I - \m){m\) ® ® Tz(g b ) ® i)\ m ) ® \vi), 
\D x (g b )) = {i®{i- \vi)(m\) ® ® T x (g b ) ® i)\ m ) ® lm>, 

where (a, 6) S {1, ...,7V} x {1,...,M}, € A = |^ fc = 0, . .., 7 j> arc independently and uniformly distributed 

random numbers which are secret to Bob, and the two qubit operators Tz(^ b ) and Tx(^ b ) are defined by 

Tz& = |00)(00|+e<M01)(01| + |10)(10| + |ll)(ll|, 

^(^ 6 ) = ( g l?/2> + 2 1??4> ) <7?21 + ( 2 |7?2> + 2 1??4> ) <7?41 + |7/1><??l1 + |7?3><??31 ' 

Alice sends all these Dango states to Bob, and records all {^f b X } for the later use [35|. Bob arranges all the Dango 
states in a lattice with 27V columns and M rows. 

Alice chooses a parameter n < N. We call a collection of n Dango states, sent by Alice to be kept in Bob's memory, 
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" (k,b)th Z-Dango chain states" or "(fc,&)th A-Dango chain states" defines as (see Fig.[3](b)) 

n 

= 0i^(ef*-i)«+i,6)>. 

3=1 
3=1 

where k = I,..., N/n and b = 1,...,M. A Z-Dango chain state is used for the implementation of a singlc-qubit 
Z-rotation whereas an A-Dango chain state is used for the implementation a single-qubit A-rotation. However, to 
hide the actual structure of the computation Alice will work with a regular one-dimensional chain, called "Combo 
chain state" |C&), composed of N/n Z-Dango chain states and N/n A-Dango chain states (Fig. G2(c)) with two-edge 
qubits projected on \R*) and \L) states, respectively (Fig. H](a)): 

\C b ) = (R*\(L\(\B* /n J ® \B z N/ntb ) ® ... ® \B* b ) ® \Bl b ) ® \B* b ) ® \B* b ] 

(b = 1,...,M). Here, \L) = (|0) + i\l))/\J~2 and \R) = |0). However, could be any arbitrary state depending on 
Alice's desired input using the uploading method [37| . 

Now in order to entangle qubits of the Combo chain to create the desired resource state, Bob will perform the 
following operators. Let us define the PEPS operation to be [30l - l32j 



V Z 1=1 1=0 j=0 



which creates a qutrit from two qubits, where .Aj is (i, j)-element of the matrix A[l]. Consider the following unitary 
operators acting on a qutrit 

Z/X if z l x it Z / X if Z l X 



z/xs = fl + e^ h , , l-e*-» ,„.%.., , /l~e^» h , , 1 + e 



>s»,i 



U(C!n = {—^ 11> + g l^j^+l 2 |1> + ^ |2>J(2| + |3)(3|, 

V = |3)(1| + |1)(2| + |2)(3|. 
It is easy to verify that 

PTz(£i X ) = U{C! b X )P, 
PTx{£i X ) = V^U{g'*)VP. 

Bob has to apply the filtering operation J— |r/i)(ryi|. In order to do so, he performs the measurement {\r]i){r)i\, I — 
l 7 ?i)( 7 ?i|} to every pair of two qubits in the Combo chain which is specified by a dotted blue circle in Fig. |4] (b). If 
|ryi)(?7i| is realised, two qubits are just removed from the chain (Fig. @] (c)). Next Bob applies the PEPS operation 
P to each pair of two qubits in order to obtain qutrits (Fig. 2] (d), (e), (f)) [38| . This PEPS operation is done 
detcrministically since I — |?7i)(?7i| is already applied to every pair of qubits. Therefore Bob has created a new 
one-dimensional chain of qutrits (Fig. H](f)) called "rotated AKLT state": 

\RAKLT 2 b N ^ R {{£i X })) = U b {{£' X })\AKLT™' L ' R ), 

where 

Um% X }) = {v*U{$ ib )V® ... ® ViU($_ n+hb )v} ® [u{e N , b ) ® ... ® U{t z N _ n+hb )) 



®{v^U{£ +nfi )V® ... ® V+tT(^ li6 )v} ® {t/(ef+„, 6 ) ® (8 C/(C,f+i, 6 )} 

®{^ f ^(^)v ® ... ® ^t/(e^)y} ® [u{^ b ) ® ... ® c/(^ fc )} 



(for simplicity, we have assumed that all filterings give We call a qutrit which is rotated by U(£ z b ) "Z- 

prerotated qutrit" and a qutrit which is rotated by VW(^ b )V "A-prerotated qutrit". Other qutrits are called "plain 
qutrits". The "(fc,b)th Z/A-prerotated AKLT subsystem" is defined to be the set of Z/ A-prerotated qutrits in 6th 
prerotated AKLT chain corresponding to particles of (k, b)th Z/A-Dango chain. 
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Protocol 1: Blind State Preparation 



• Alice sends Bob parameter values N, M and n < N. 

• Alice sends Bob N x M many Z-Dango states \D z (^ b )) where (a, b) € {1, N} x {1, M}. 

• Alice sends Bob N x M many X-Dango states \Dx(£a,b)) where (a, b) G {1, TV} x {1, M}. 

• Bob arranges the received Z-Dango states in M rows of N/n Z-Dango chains \B^ b ) where k = 1, 2, N/n, 6 = 1, M. 

• Bob arranges the received A-Dango states in M rows of N/n X-Dango chains \B* b ) where k = 1,2, N/n, b — 1, M. 

• Bob arranges the Dango chains in M rows of Combo chains \C b ) = \B*/ n b ) ® \B%/ n b ) ® ... ® \B* b ) ® |_B^ b ) . 

• Bob applies filtering and PEPS operators to create M rows of rotated AKLT states \RAKLT b N ' L ' R ({^{ X })}, where 



See also Fig. Q] 



(a) 

• • • — O OHO Or-O CHO OrO OHO OHO OHO O; 

(b) 

• • • — fc> CHO OHO C&D OfrO OHO OHO OHO O} 



♦».«♦ ♦..«♦ ♦..«♦ ♦..«♦ 



(c) 

• • • — fb OHO OHO OHO Or :0 OHO OHO O; 



* ■ • * # ■ ■ • 



"♦»-.♦* *♦»-.♦* *♦.-«♦" 



(d) P PT X P PT X PT Z P PT Z 

••• OHO OHO OHO O^ fc>OHOOHOO) 

*«...♦♦ 

^ P v + uvp P v + uvp UP P UP 

♦ ■ ■ * * ■ ■ * # ■ ■ # • ■ * • * ■ ■ * * ■ ■ * * ■ ■ * 

-fc> CHO OHO OHO O^ fc> OHO OfrO O} 



• • • 



(f) v + uv v + uv u u 

OOOO (HH) 

FIG. 4: (Color online.) (a): A chain \C). (b): The filtering operation is applied to every pair of qubits which is indicated by a 
blue dotted circle, (c): \rji){n\ \ is realized on the seventh and eighth qubits. (d): The PEPS P is applied to every pair of two 
qubits. (e): It is equivalent to (d). (f): It is equivalent to (e). Now large yellow circles are qutrits. 
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B. Blind computation protocol 

A single blind Z-rotation is performed using a Z-Dango chain state. Let us assume that Alice wants to perform the 



Z-rotation exp 



iZ nZ 
T°k.b 



with 9% b G A, using the (k, 6)th Z-Dango chain [36|. The step by step operation is given in 

Protocol 2. Note that we implement the desired Z-rotation using qutrit measurements. However, the third outcome 
1 7) leads to the failure as it implements only the trivial Pauli Z. The probability that Alice fails to implement her 
desired Z-rotation in a single Z-Dango chain is 1/3™, which is small for sufficiently large n. Similarly a blind X 
rotation could be applied (see Protocol 3) where again, the probability that Alice fails to implement her desired 
X-rotation in a single A-Dango chain is 1/3™. Note that these protocols are designed in such a way to follow the 
construction of the AKLT computation of SecHH while canceling the prerotation that was added to the resource state 
for the purpose of blindness. 

Protocol 2: Blind Z Rotation 

Initially the flag parameter (known to both Alice and Bob) is set r = 1. For j = 1- ■ - n Alice and Bob perform the following 

steps. 

(I) Alice sends Bob the angle 

4>(k-l)n+j,b = TSk,b + £(k-l)n+j,b + ^ r (k~l)n+j,b (mod 2%) , 

where rf k _ 1 \ n+ j b £ {0, 1} is a random number which is secret to Bob. If there is the X byproduct before this step, 6 kb 
should be replaced with —8 kb in order to compensate this byproduct operator. However, Z byproduct commutes trivially 
with the operation implemented in the correlation space, and therefore it can be corrected at the end of computation. 

(II) Bob measures the j'th Z-prerotated qutrit of the (fc, &)th Z-prerotated AKLT subsystem in the basis 



M((fif k - 1)n+J , b ) = {\ot(<j>fk-l)n+j,b)}, \/3(<j>fk-l)n+j,b)), \f)}, 



where 



|a(^>ffc_i)„ +J , 6 )) = L — : — — |1)H L — : — — 12), 



1 + exp [i</>f fc _ 1)n+J , 6 ] 1 - exp \i<j>f k _ 1)n 



)n+3,b 



mf k - 1)n+3 , b )) = ~ 2 j 11) + ~ - j 12), 

It) = |3). 



1 - exp [#f fc _ 1)n+J , b ] 1 + exp \i<t>f k _ 1)n+j>b 



and sends the result to Alice. 

• If the measurement result is \oi(4>f k _x) n -\-j (,)), 



Rz(T0k, b ,r( k -i) n +j,b) = exp [ lT ^ k ' b ^ A'Z^-'l-tj.' exp \^-T0 k ^ 



is implemented in the correlation space and Alice sets r = 0. 

(fc-l)n+j,b) 



• If the measurement result is \P(4>fk-v>n+j b)) 



R z (r0lb,rf k - 1)n+J , b ) =exp [-^^] XZ r ?*-^+i>» +1 exp [^r< 6 ] 



is implemented in the correlation space and Alice sets t = 0. 
• If the measurement result is I7), Z is implemented in the correlation space. 
The probability of obtaining each result is 1/3. 
(Ill) Bob does the measurement {|1), |2), |3)} on the next plain qutrit if any. 



Let us finally explain how the two-qubit operation of controlled-Z (CZ) is performed. In order to perform CZ 
gates blindly, CZ gates are periodically implemented with the period that is independent of Alice's input and the 
algorithm. In this case, Bob learns nothing from the period. Because of the periodic implementation of CZ gates, 
Alice sometimes experiences an unwanted CZ gate. However, Alice can cancel the effect of an unwanted CZ gate by 
implementing the trivial identity operation (plus Pauli byproduct operations) until she arrives at the next CZ gate 
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Protocol 3: Blind X Rotation 



Initially the flag parameter (known to both Alice and Bob) is set r = 1. For j = 1 ■ ■ ■ n Alice and Bob perform the following 

steps. 



(I) Alice sends Bob the angle 



t>(k-i)n+j,b = T @k,b + £?k-i)n+j,b + rf k _ 1)n+ j. b -K (mod 27r), 



where r x ._ 1 \ n+ j b £ {0, 1} is a random number which is secret to Bob. If there is the Z byproduct operator before 
this step, 9 kb should be replaced with — 9 kb in order to compensate this byproduct operator. However, X byproduct 
commutes trivially with the operation implemented in the correlation space, and therefore it can be corrected at the end 
of computation. 

(II) Bob applies V on the jth A-prerotated qutrit of the (k, b)th A-prerotated AKLT subsystem, and does the measurement 
in the basis 



M((fif k - 1)n+J , b ) = {|a(0(fc-l)n+j,i.))i \P(<l>(k-l)n+j,b)), It)}) 



where 



[*0(fc-l)n+i,b] 



1 + exp \i<j) (k _ 1)n+i A 1-exp \i 



(k-l)n+j,b 



a(0f fc _ 1)n+Jii )) = L — + L — i|2> 



\P(<t>(i-i) n+3 ,b)) = ~ 2 ~ J |1) + " 2 J |2>, 

l7> = |3>. 



1 - exp [i^_i )n+3 - i6 ] ^ 1 + exp [i^_i )n+ji6 ] 



and sends the result to Alice. 



If the measurement result is \&(.<l>(L—i)n+j b )), 



X . -AY 

iX 



is implemented in the correlation space and Alice sets t = 0. 

(fe-l)n+j',i)))' 



• If the measurement result is \P{4>f k -r\n+j b )) 



R x (re^ b ,rf k _ 1)n+jib ) = exp [^M]x r <^>»+-^exp [■ 



-7T Te k,b 



is implemented in the correlation space and Alice sets r = 0. 
• If the measurement result is I7), X is implemented. 
The probability of obtaining each result is 1/3. 
(Ill) Bob performs the measurement {|1), |2), |3)} on the next plain qutrit if any. 



which cancels the previous one. This is possible due to the following commutation rules. 



CZ(1® X)CZ 
CZ{I®Z)CZ 
CZ(X®I)CZ 
CZ{Z®I)CZ 



z®x, 

I0Z, 

x®z, 

Z®I. 



In Protocol 4, we explain how to implement the CZ gate plus Z-rotation 



exp 



\iZ ftZ - 




'iZ z ' 






(g> exp 


_~J k '' b '. 


) 



\cz 



between (k, b)th and (k', b')th Z-prerotated AKLT subsystems, where 8% b , 6>f, b , G A. Note that the local Z rotations 
are required to cancel the prerotations of qutrits. The probability that Alice fails to implement the CZ gate in this 
algorithm is (5/9)", which is small for large n. 
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Protocol 4: Controlled-Z followed by Blind Z-rotations 



Initially the flag parameters (known to both Alice and Bob) are set r = 1, r' = 1 and e = 1. For j = 1 • • • n Alice and Bob 

perform the following steps. 

(I) If e = 0, skip this step. Bob applies the unitary operation 

w _ 11,1) + 2) + ]2,1) -12, 2) 

| 11,1) + 11,2) -12,1) + 12,2) 

| 11,1) - [I, 2) + 12,1) + 12, 2) 

| -11,1) + |1,2) + |2,1) + |2,2) 

+|1, 3)<1, 3] + ]2, 3)(2, 3) + |3, 1)<3, 1| + |3, 2)(3, 2| + |3, 3)(3, 3| 

between jih Z-prerotated qutrit of (fc, 6)th Z-prerotated AKLT subsystem and jth Z-prerotated qutrit of (k',b')th 
Z-prerotated AKLT subsystem. 

(II) Alice sends Bob the angles 

(j>fk-i)n+j,b = T~0k,b + £(k-l)n+j,b + r(k-l)n+j,bn (mod27r), 
4>{h'-V)n+j,V = T0k>,b> + £(k'-i)n+j,b' + rf k '-i)n+j,b<K (mod 2tt), 



where r( fc _ 1 ) n _ ) _j b , r/ 4 ;_ 1 \ n+ j y £ {0, 1} are random numbers. If there is any byproduct which contains X before this step, 
the sign of #f b or (9 Z b , should be appropriately changed. However, Z byproduct commutes trivially with the operation 
implemented in the correlation space, and therefore it can be corrected at the end of computation. 

(Ill) Bob does the measurement -M.{4>fk-i)n+i b) (^ ne same as that of Protocol 1) on the jth Z-prerotated qutrit of the (k, 6)th 
Z-prerotated AKLT subsystem and the measurement M{4>{k' -i) n +j ti) on the Jth Z-prerotated qutrit of the (k',b')ih 
Z-prerotated AKLT subsystem. The operation implemented in the correlation space is summarized as follows: 



\a((pfk-i) n +j,b)) 


8 \ot{<t>fk'-l)n+j,b>)) 


[Rz(t( 


1 k,bi r (k- 


l)n+j,b) t 




9%', v 


Z 
1 ~{k 


-T)n+j,b') 




\a((pfk-i) n +j,b)) 


%\P(<f>fk'-l) n+j ,v)) 


[Rz(rt 


'fc,f>, r (k- 


l)n+j,b) C 




%>,b> 


Z 


-l)n+J,6' ) 




\&(<l>(k-i) n +j,b)) 


8 |7): ^S(^L,rf fe 


— l)n+j,6v 


®Z 














\P(4>(k-T)n+j,b)) ( 


g> \u{<t>fk' -l)n+ j,b')) 


[i?§(r( 


1 Z r Z 


l)n+j,b) •< 




%',V 


r Z 
1 r (k> 


-l)n+j,b') 




\P(4>(k-T)n+i,b)) ( 


*>\P{<t>fv-i) n +},b')) 


[i?§(rf 


3Z „z 
'k,b, r (k- 


l)n+j,b) *< 


$R Z ( T ' 


aZ 

7 k',b' 


r (k' 


-l)n+j,b') 




\P(4>(k-T)n+i,b)) ( 


8| 7 >: Ri(rel b ,rf k 


-l)n+3,b. 


®Z 














|7) ® \a(4>fk'-l)n 


+jM )): Z®R a z (r'b 


fc'.b' ! ' (fe' 


-l)n+j,b 


) 












|7) ® Wfk'-X)n 


+jtV )): Z®R? z {t'6 


z , , r? , 
fc',6' i ' (k' 


-l)n+j,b 


) 












|7) ® I7): z® z 





















(IV) If the ^-rotation by Q z b is implemented in the preivous step, then Alice sets r = 0. If the z-rotation by 8 Z , b , is 
implemented in the previous step, then Alice sets t' = 0. If the CZ is implemented in the previous step, then Alice sets 
e = 0. 

(V) Bob does the measurement {|1), |2), |3)} on the next plain qutrit if any. 



C. Ground state computing 



In the single-server protocol, it is not easy for Bob to enjoy the energy-gap protection, since Bob cannot prepare 
any natural parent Hamiltonian without knowing {£ a b }■ This is understood as follows. 
Let us consider the span 

{ \RAKLTt N L R {{£! b X })) j CT" 6 A a = 1, N } 
of all rotated AKLT states. As is shown below, the dimension of the span is 2 2N . Therefore, if Bob does not know 
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{£<f fc A }' ne mus t prepare an unnatural Hamiltonian with exponentially-degenerated ground states. 
Let us show that the dimension of the span is 2 2N . Let 

2N 

\^2N) = \<t>0) 8> (® |&)) ® l<?W+l), 
i=l 

where \<f>o) and \4>2N+i) are qubit states, and \4>i) (i — 1, ...,2N) are qutrit states. Let 

be a grobal unitary operator, where is the identity operator on a single qubit. Let E is a global unitary operator 
which works as 

E\i> 2N ) = \AKLT 2NLR ). 
From Lemma below and the fact that E^ is unitary, 

dim^spanjUi-i^l^iv) j J) = dim^span|(U^)' t '|V'2Jv)} - 



dim^spanj^tutlV^w)}. 
dim (span{ut| V>2iv) } ^ 
dim (span ju ? -| i/j 2 n) j , 



f 



2 2N . 



Lemma: Let {Vi, . . . V r } be a set of r operators, and let \<j>) be a state in their domain. Then 

dim^span|V;|(/))| J = dim^spanjl/^|0) j J . 

Proof: Recall that dim^spanjVi|</>) j ^ is equal to the rank of the Gram matrix of the set of vectors {Vi|0)}i. Also 
note that if Ga is the Gram matrix of the set of vectors {V^|</>)} 2 ; and Gb is the Gram matrix of the set of vectors 
{V^|</>)}j, then Ga = G* B . Finally, let us remind that rank(A) = rank(A*) for all matrices A. 



IV. BLINDNESS OF THE SINGLE-SERVER PROTOCOL 



In this section, we show the blindness of the single-server protocol (composed of Protocols 2, 3, 4). Informally 
speaking, a protocol is defined to be blind if Bob, given all the classical and quantum information during the protocol, 
cannot learn anything about the Alice's actual computational angles, input and the output 0. In the original paper 
for the blind quantum computation over the cluster states 0] blindness is formally defined in terms of the independence 
of classical and quantum states of Bob from Alice's secret. Here we adapt the definition to our setting but we omit a 
formal proof of the equivalences between the two definitions. 

Definition 1 A single-server protocol is blind if 

(51) The conditional probability distribution of Alice's nontrivial computational angles, given all the classical infor- 
mation Bob can obtain during the protocol, and given the measurement results of any POVMs which Bob may 
perform on his system at any stage of the protocol, is uniform, 

and 

(52) The register state in the correlation space is one-time padded to Bob. 
In order to show (SI), we have to show three lemmas. 

In the following we define $, 0, S and R to be independently and uniformly distributed random variables, corre- 
sponding to the angles sent by Alice to Bob, Alice's secret computational angle, random prerotation and a hidden 
binary parameter, respectively. From the construction of the protocol, the following relation is satisfied: 



$ = + S + i?7r (mod 27r). 
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Wc denote by ps the state that Alice sends to Bob parametrized by 3. The most general method Bob may resort to in 
order to learn Alice's secret computational angles is described by a POVM measurement {H :7 -}^. 1 on p£. This POVM 
can depend on all classical messages received from Alice. Let O £ {1, ...,m} be the random variable corresponding 
to the result of the POVM measurement. Bob's knowledge about Alice's secret angles is given by the conditional 
probability distribution of = 6 given O = j and $ = </>: 

P(Q = 0\O = j,$ = <j>). 

Lemma 1 If ps is a Dango state \D z /x{£))(D z /x{£)\, then P(6 = 9\0 = j, $ = <j>) = g for any 6,(j> £ A, 
j £ {1, m}, and POVM on p~. 

Proof: From Bayes' theorem, we have 

PCe-io-*.-,, - na^ l e ; ^ fj e r ,,^ ) 

p(o = j\e = 6,<s> = <j))p(e = 6>)p($ = 0) 
p(o = j|$ = (j))p(<p = 4>) 

1 ^[nilEr^-e-rTr] 



8 ^[Hj'gsSe.r^-e-rTr] 

If is a Dango state |.Dz/x(3))(-Dz/x(3)|, we obtain 

1 ^ _ 11 ^ 

2 P<t>-9-rir - 2 g 

r 9,r 

for any (f>,0 £ [0, 27r], and hence P(G = #|0 = j, $ = </>) = 1/8. The above equation is valid since 

/ 1 e"^ 1 1 \ 

1 r n 

j e -« ! ! ® 0i 2 [I® (I - |r/i)(rji|) ® J], 

\ 1 e - ^ 1 1 y 

where O12 is the 12 x 12 zero matrix and the 4x4 matrix is in the basis { |0000) , |0011), |1100), |1111)}, and there 
exists a unitary which maps (I <g> T z {£) ® I)\m) ® \m) to (I ® T x (£) ® ® k/i)- ■ 

Lemma 2 Consider a collection of L states {pEi}i such that for each I = 1, . . . ,L we have 

1 



\d z (0)(Dz(0\ = [i®(i-\rn)(m\)®i 



1 



p e 



n = 01 



L = j, 



where $>i, O;, 3j and Ri are defined as before. Also, O l are the random variables corresponding to (arbitrary) POVMs 
performed on individual systems. Then for any global POVM performed on the entire collection of L states we have 



p(e = (e 1 ,...,e L )\o = j,$ = (</>!,..., h)) = 

where O is the random variable corresponding to the outcome of the global POVM. 
Proof: Similar to the previous proof, from Bayes' theorem, we have 



p[e = (e 1 ,...,e L ) 



o = j, $ = 



91 J 



p(o = j 


9=(0 1 ,...,0 L ),$=(<l> l ,...,<j> L ))p 


(e = (e 1 ,...,0 L ),$ = (0 1 ,...,0 L )) 


p(o = j 


Q = {e 1 ,...,e L )^ = {4>u-,4>L))P 


:,4>L)) 

(e = (^ 1 ,...,^))p($ = (0 1 ,...,0 L )) 


p(o = 3$ = {4>u..,4>l)) 

1 Tr Ilj (g)f =1 \ Y, Ti P<P t -e t -r,Tr 


P($=(0!,...,^)) 
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Let us define two local operators acting on Zth state ph ( by 



Tr 



l,...,i-l,J+l,...,L 



n' = Tti,...,i-i,i+i,...,L 



l-l 1 L j 

?— 1 n 

I— 1 2^ L 1 1 

1=1 Sj.r; i=i+l 6i,ri 



The partial trace is a CPTP superoperator, hence the above operators are non-negative operators, and since 

m 

E n ^ = r, 

3 = 1 
rn 

3=1 

hence {II*. and {& j }JLi are local POVMs on Zth state. 

Let and O l be the random variables which correspond to the results of the POVMs {LT^}^_ 1 and {tl^JL-^, 
respectively. Then, we have 

p(e = {6 1 ,...,9 L )o = j,$> = {fa,...,4> L ) 



1 ^ 


Hj 2 J^ ri Pifit-ei-riTr 






nl 1 1 y „ 
1L j 8 2 £-^8i,n Hpi—Bi—nir 



1 P(O l = 3^1=^1 = 0Q 
8 L P(6 l = = 00 

1 P(Q' = jjgj = 0;, 6; = gj) P(O f = jjjj = 

1 P(Q ; = jjjj = = 0QP($, = <t>i)P(&i = gi) P(Q ; = jjgj = 0;) 

8 i - 1 P(O l = = <f>i)P($i = <j>i) P(O l = j\$i = fa) 

1 P(O l = =4> h Qi = 6t)P(<Z>i = 4>u e ; = 0i) P(O l = jfa = 00 



8 L-1 

1 



p{o l = j, = <p{) p(o« = = ^0 

_P ( 8, =8 ,|^^„ - =J /< '°^-°« 

i p(o' = jj$i = 0Q 

8 L p(6' =j|$, =00' 



p(o' = = 00 



Note that P{O l = = 00 and P(O l = j|<3?; =00 are independent of 9i, and hence 

p(e = (0i,...,0 L ) o = i,$ = (0i,...,0 i ) > 



is also independent of 6*;. The same result holds for any I = 1, L, hence the proof is completed. ■ 

Recall that a single X/Z Dango chain is used for the implementation of a fixed X/Z rotation. The following lemma 
shows this information does not help Bob to learn about Alice's secret. 

Lemma 3 Under the assumptions of Lemma assume that O takes values with a non-zero probability only in a 
subset K, i.e. 9eA'c A xL . Then 



p(e = e|o = j,$ = (0 1 ,...,0 L ),ee^) = -L 



for any 9 6 K, (0i,...,0l) G A xL , j £ {1, ...,m}, and POVM on (g) 4=1 p E 
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Proof: Similar to the previous proofs, we have 



p e = 00 = j, <!> = (</>!,..., eg a- = 



p 


f e = e,eeK 




p(ee 





1/8 L 
\K\/V 



p 


f Q = 6 


= 


-- j, $ = 


[<t>u—,<t>iS\ 


p 







Theorem 1 The single- server protocol satisfies (SI). 

Proof: Bob receives 2NM Dango states, and therefore there are 2NM secret angles }^b)=(i iy Bob also 



receives 2NM angles 



a,b / ( a ,6)=(l,l) 



from Alice. Let 0, $ G A 



X2NM 



be random variables, and O G {1, ...,m} be 



the random variable which corresponds to the result of the POVM measurement which Bob performs on his system. 
Since Bob knows that Alice tries the same rotation many times in a single Z/V-AKLT subsystem until she succeeds, 
and that after the success of the rotation Alice implements the trivial identity operation on the rest of qutrits in 
the Z/V-AKLT subsystem, Bob can assume that takes values only in a subset K: G K C A x2NM , where 
\K\ = 8 2NM / n . 

From Lemma 1, 2, and 3, we have the following equality V0 G K, ~i^ Z J b G A, (a = 1,...,N), (b = 1,...,M), 
j G {!,•••, m}, and for any POVM 



P 6 = 



J a,b /(a.b) = (l,l)' U fc ^) - \ K \ 



Theorem 2 The single- server protocol satisfies (S2). 
Proof: It is easy to see 



• When 



'k,bi 1 (k-l)n+j,b 



) or R 



9 Z r z 

'k,b' ' (k-l)n+j,b 



) is implemented in the correlation space, the byproduct 



IZ'c-'i'+j' 1 or X Z r ( k -v n +j> b+1 occurs, respectively. If Bob has no information about the value of r z k _ 1 - jn+ j b , 
he cannot know whether the byproduct Z appears or not. 



(k-l)n+j,b 



) is implemented in the correlation space, the byproduct 



or B? x {9l b ,r x 

i) n +j,b+ 1 z or X r l k ~ 1 '>™+i' b Z occurs, respectively. If Bob has no information about the value of r^ k _ l ^ n+ - b , 



.When R a x {9l b ,rf k _ 1)n+hb 



he cannot know whether the byproduct X appears or not. 

Note that we assume Alice's computation is implemented via a regular structure hence it contains both X and Z 
rotations. Therefore both byproducts of Pauli X and Z operators will appear leading to the full one-time padding 
of the computation in the correlation space. In fact, we can show that Bob cannot have any information about the 



values of {r 



z/x 

k—l)n+j : b 



} by showing similar proofs as those for {9 



z/x- 



z/x 



z fx. z fx 

values only or 7r in the above proofs leading to the exchange of the role of {rtl-Un+i b\ an< ^ i^k b } 



}. However, it is easy to consider that 9 k . 

z/x 

(k-l)n+j,b 



takes 



V. DOUBLE-SERVER PROTOCOL 



In this section, we will explain the double-server protocol (Fig. [2j. There are two advantages behind the new 
protocol: Alice could be completely classical and more importantly the resource state preparation and computation 
could be done more robustly using the energy-gap protection. To achieve these new features while keeping the security 
requirement intact, it is assumed that the two servers, Bobl and Bob2, share many Bell pairs but have no classical or 
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quantum channel between them. As we will discuss later it is an interesting open question (both from the practical 
and theoretical perspective) whether this assumption could be relaxed. 

In the double-server protocol, Bobl first creates AKLT resource states (without any random rotation), hence the 
preparation and storage of the state could be performed using ground state energy-gap protection as described in 
details in [lij . Next, depending on Alice's desired gates, Bobl adiabatically turns off the interaction between some 
particles and the rest of particles in his resource state, and teleports these particles to Bob2 by consuming Bell pairs. 
Bobl sends Alice the result of the measurement in the teleportation through the classical channel. Note that due to 
the lack of any communication (classical or quantum) channels between Bobl and Bob2, the teleportation procedure 
from Bobs' point of view can be seen as a usage of a totally mixed channel where only Alice knows how to correct 
the output of the channel. 

Next, Alice calculates the angle in which particles should be measured by using her classical computer, and sends 
Bob2 the angle which is the sum of the calculated angle plus the compensation for the byproduct and a random angle 
to hide the actual angle of the computation. Bob2 performs the measurement in that angle and sends the result of 
the measurement to Alice. Next, Alice sends the previous random angle to Bobl and he does the single-qubit rotation 
which compensates the added random angle. Bobl and Bob2 repeat this two-way classical communication with Alice 
until they finish the computation. 




FIG. 5: (Color online.) (a): A chain \AKLT N ' ' ). Each AKLT subsystem is specified with a blue circle. In this example, 
n = 4. (b): Bobl adiabatically turns off the interaction between a qutrit and others, and applies P* to the qutrit in order to 
convert this qutrit into a pair of two qubits. (c): Bobl teleports thus created two qubits to Bob2 by consuming two Bell pairs, 
(d): Because of the teleportation, Pauli errors E and E' occur. 



We define a (k,b)th AKLT subsystem (k = l,...,N/n, b — 1,...,M) to be the collection of n qutrits of the 6th 
AKLT chain with column index (k — l)n + 1, (k — l)n + 2, (k — l)n + n (Fig. [5] (a)). A single-qubit rotation is 
implemented in a single AKLT subsystem. Let us assume that Alice wants to perform the single-qubit Z-rotation 

exp nfOkb with 9% b € A using (fc, 6)th AKLT subsystem (Protocol 5). The protocol for implementing an arbitrary 

A-rotation is similar and is given in the Appendix [Cl Finally, in order to perform blind CZ gates, similar to the 
single-sever protocol, Bobl periodically implements CZ gates. In order to keep the register state in the ground space, 
the interactions are adiabatically turned off before each CZ gate. Unwanted CZ gates are canceled in the same way 
as that in the single-server protocol. 
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Protocol 5: Double-server Blind Z rotation 



Initially the flag parameter (known to only Alice) is set t = 1. Alice sets her secret parameter e% b = and also chooses 
random numbers 5jf 6 £ .A. Alice sends Bobl parameter values A, M and n < N. Bobl creates M AKLT chains 
\AKLT b N ' L,R ), where 6=1, M (see Equation[T]) of N qutrits arranged in an array of N columns and M rows. For 

j = 1 • • -n/2 Alice, Bobl, and Bob2 repeat (I)-(VI). 

(I) Bobl adiabatically turns off the interaction which acts on the jr'th qutrit of (k, b)th AKLT subsystem and applies P^ to 
the isolated qutrit in order to convert the qutrit into the pair of two qubits (Fig. \5\ (b)). (The application of P* can be 
done deterministically. For the physical implementation of P* , see Appendix |A"1) 

(II) Bobl teleports the created two qubits to Bob2 by consuming two Bell pairs (Fig. [5] (c)). These two teleported qubits are 
affected by a two-qubit Pauli error E ® E' G {/, X, Z, XZ} {I, X, Z, XZ} (Fig. [5] (d)). Bobl sends Alice the result of 
the measurement in the teleportation and hence only Alice and Bobl knows which error appears. 

(III) Bob2 applies the filtering operation {/ — |?7i){??i|} to the received two qubits, and sends the result to Alice. 

• If the Pauli error is I ® I, X ® X, Z ® Z, or XZ ® XZ, the probability of realizing is 0. 

• If the Pauli error is I <g) Z, X ® XZ, Z ® /, or XZ ® X, |?7i)(^i| is realized with the probability 1/3. If |»ji)(rji| is 
realized, Z is implemented in the correlation space. 

• If the Pauli error is I ® X, X ® I, Z ® XZ, or XZ (g> Z, is realized with the probability 1/3. If is 
realized, X is implemented in the correlation space. 

• If the Pauli error is / ® XZ, X (?) Z, Z ® X, or XZ (g> /, |?7i)(»?i| is realized with the probability 1/3. If |?7i)(??i| is 
realized, XZ is implemented in the correlation space. 

If |?7i)(?7i| is realized, skip steps (IV), (V) and (VI). If/ — |??i)(?7i| is realized, Bob2 further applies the PEPS operation 
P on the two qubits. This PEPS operation is done deterministically, because the two qubits are already projected by 

(IV) Alice sends the angle 4>fk-i)n+j b 1° Bob2. This angle is determined according to the following rule: 

• If the Pauli error is I ® /, I « Z, Z » /, or Z » Z, 



)n+j,b — T^k.b + T ^k,b + £(k-l)n+j,b + r (k~l)n+j,b 7v (mod 27r), 



where ifk-i)n+j,b e an d r (k-i)n+j,b e {0> 1} are random numbers chosen by Alice, and signs of #f 6 and 5jf 6 
should be changed if there is the byproduct X before this step. 

• If the Pauli error is X <g> X, X ® XZ, XZ ® X, or XZ <g> XZ, 

4>fk-l)n+],b = ~T0k,b - T&k,b ~ C(fe-l)n+j,6 + rf k - l)n+j,b^ ( mod 2 7t), 

where C^._ 1 ) n+J b £ A and rf k _ 1 \ n+ j b € {0, 1} are random numbers chosen by Alice, and signs of 8^ b and 5jf 6 
should be changed if there is the byproduct X before this step. 

• If the Pauli error is I ® X, I ® XZ, X <g> I , X ® Z, Z ® X , Z ® XZ, XZ ® /, or XZ <g> Z, 

iZ _ c z 

<P(k-l)n+j,b — f,(k-l)n+j,b 

where £fk-i)n+j b G -4 is a random number chosen by Alice. 

(V) Bob2 does the measurement M(<pf k _ 1 ^ n+: j b ) (similar to Protocol 2), and sends the result to Alice. By this measurement, 
following operations are implemented in the correlation space (see also Appendix |B)) : 

• If the Pauli error is / ® / or Z ® Z, \a(4>f k _ 1 - )n+ j b )) , \fi(4>f k -i)n+j !>))> or It) occurs with the probability 1/3 
respectively. If \oi{4>fk-i)n+j,b)) ls realized, 

XZ rf^ 1)n+jib exp J!| (^QZ h + ^ + ^ k _ 1)n+ . ^ ] 

is implemented. If \l3{4>fk-i)n+j,b)) i s realized, 

XZ r( k . 1)n+j , b+ l exp ]iZ ^ + T5 Z k b + C f fc _ 1)+j 6 )] 

is implemented. If I7) is realized, Z is implemented. 
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Protocol 5: 



Continued 



(V) — Continued 



If the Pauli error is 7" <g> Z or Z® J, \<x(<l>fk-i)n+j t)) or IPi't'fk-^n+j b)) occurs with the probability 1/2 respectively. 
If \a{4>fk-i) n +j,b)) is realized, 

\iZ i 



is implemented. If \/3(4>fk-i)n+j t)) i s realized, 



XZ rf k _ 1)n+j:b exp + tS z^ + ft^^ 



is implemented. 

If the Pauli error is X X or XZ ® XZ, \a(4>fk-i) n +j,b))y \P{4>(k-i)n+i,b)) ■ or ll) occurs with the probability 1/3 
respectively. If «(0ffc-i)n+j,6)) is realized, 



X2 r (n)»+i,i 



exp (r6>f, b + rSk,b + £(k-i)n+j,b) 



is implemented. If \P{4'fk-i)n+j,b)) i s realized, 



exp (r0f, 6 + r*£j + if k -l)n +j , 



is implemented. If I7} is realized, Z is implemented. 

If the Pauli error is X ® XZ or XZ ® X, |a(^f fc _ 1)B+Jji )> or \/3(ct>f k _ 1)n+jjb )) 
respectively. If \a{<t>( h -l)n+j,b)) is realized, 

xz rf h . 1)n+j , b +i exp J!| + Tg z b + f {k _ l)n+j 



is implemented. If \f3(4>fk-i)n+j,b)) i s realized, 



XZ'ffc-D^.o exp (r^ + TSl b + £f fc _ 



l)n+j,i) 



occurs with the probability 1/2 



is implemented. 

If the Pauli error is / ® X, X ® /, Z ® XZ, or XZ ® Z, |Q(0f fe _i )n+:)ii) )>, \P{4>fk-i)n+j,b)) 1 or |7> occurs with the 



probability \sm 2 [^(f>? k _ 1 



2^(fe-l)«+j,6i' 2 



l2^(k-l)n+j,bh 



or 1/2, respectively. If 



y (fc-l)n+j,i> 



)) or |/?(^f fc _ 1)n+ ,, ft )> is 



realized, Z is implemented. If I7} is realized, XZ is implemented. 
• If the Pauli error is J ® XZ, X ® Z, Z ® X, or XZ ® 7, |a(^_i)„ +i)fc )), IW(k-i) n +j,&))) or \l) occurs with the 
probability \ cos 2 [±</f fc _ 1)n+j ft ], ± sin 2 [f 0f fc _ 1)n+jjil ], or 1/2, respectively. If \a((j>f k _ 1)n+jtb )) or \l3(<j>f k _ 1)n+jtb )} is 
realized, Z is implemented. If I7) is realized, X is implemented. 

(VI) If the z-rotation exp[^-(rSf (, + r8 k ^ b + £(k-i) n +j b)] ls implemented in the previous step, Alice sets r = 0, and e kb = 
e k,b + t,(k-i)n+j,b (mod 27r) (if there is no X byproduct before this rotation) or e kb = ef 6 — £(*-i)n+j,i (mod 2tv) (if there 
is the X byproduct before this rotation). 

(VII) So far, the z-rotation 



Gf j6 exp \^Y^k,b +<5f,b)] exp [■y6 l fc,i> 



iZ. 



up to some Pauli byproduct Gf |i; is implemented. The probability that they fail to perform this z-rotation is (2/3) n,/2 , 
which is small for sufficiently large n. Alice asks Bobl to correct the accumulated error. In order to do so she sends 



Bobl the angle e k b = e k b + 8 k b (mod 2n) if G k b contains no X byproduct, and e k b 



5t b (mod 2tt) if Gt i 



contains the X byproduct. Bobl implements the rotation exp | — ^ef^J by using the rest of the qutrits in (fc, 6)th AKLT 
subsystem. The probability that Bobl fails to perform this z-rotation is (l/3) n ^ 2 , which is small for sufficiently large n. 
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VI. BLINDNESS OF THE DOUBLE-SERVER PROTOCOL 

In this section, we will show the blindness of the double-server protocol. 
Definition 2 A double-sever protocol is blind if 

(Dl) The conditional probability distribution of Alice's nontrivial computational angles, given all the classical infor- 
mation Bobl can obtain during the protocol, and given the measurement results of any POVMs which Bobl may 
perform on his system at any stage of the protocol, is uniform, 

(D2) The conditional probability distribution of Alice's nontrivial computational angles, given all the classical infor- 
mation Bob2 can obtain during the protocol, and given the measurement results of any POVMs which Bob2 may 
perform on his system at any stage of the protocol, is uniform, 

(D3) The register state in the correlation space is one-time padded to Bobl, 

(D4) The register state in the correlation space is one-time padded to Bob2. 

The proof is based on following lemmas. 

Lemma 4 Bobl cannot send any information to Bob2. 

Proof: By the assumption, there is no channel between Bobl and Bob2. Furthermore, Bobl cannot send any 
information to Bob2 via Alice either. This is due to the following facts. First, what Bobl sends to Alice are the 
"results of measurements in teleportations" . Second, what Alice sends to Bob2 are {4>f/^\ , ■ b }- Third, recall that 



Alice chooses the definition of each ^fh—i i 4. ■ j, among 



(k-l)n+j,bJ 

{k-l)n+j,b 



Z/X _ ^ a Z/X . rZ/X . e z/x . z/x 



(k-l)n+j,b ~ TO k',b~ + rS k!b +^k-l)n+j,b+ r (k-l)n+j,b' K (mod 2tt), 
<l>(k-l)n+j,b = ~ T6 k!b X ~ TS k!b X ~ t(k-l)n+j,b + r (k-l)n+j, ( mod27r ), 

or 

,z/x _ £ z/x 

according to what Bobl sends to Alice. However, the value of each <^l* x \ n+ j b is independent of what Bobl sends to 

z/x z/x 
Alice, since £( fc _]\ n _|_j b is completely random and therefore 4'(k-i)n+j b takes any value in A with equal probability, 

whichever definition Alice chooses. Therefore, 



P T = t 



p 


{* = {<t>*l-l)n+j,b} 


T = i 


P 








') 





= P T = t 



where T is the random variable which represents teleportation results. 

Finally, Bell pairs shared between Bobl and Bob2 cannot transmit any information from Bobl to Bob2 without 
sending a classical message from Bobl to Bob2, since if it is possible, information is transfcred faster than light from 
Bobl to Bob2. ■ 

Lemma 5 Bob2 cannot send any information to Bobl. 

Proof: Similar to the previous lemma, Bob2 cannot send any information to Bobl via Alice. This is due to the 
following facts. First, what Bob2 sends to Alice are the "results of filterings and measurements". Second, what Alice 

sends to Bobl are {e^ b X }. Third, although ef ^ depends on what Bob2 sends Alice, t^ b X is independent of what 

z/x 

Bob2 sends Alice, since 8 k b is completely random. Therefore, 



P(F = f 



E - {fk!b X }) = 



p 


{E = {fki X } 


F = f) 


P 


('-') 


p 


[E = {f k (b X 


>) 





p 



(*-')■ 
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where F is the random variable which represents the results of filterings and measurements. ■ 
Theorem 3 The double-server protocol satisfies (D2). 

Proof: From Lemma 4, Bobl cannot send any information to Bob2. Therefore, all quantum states which Bob2 

h z/x , 

\k-l)n+j,bl 



receives are completely mixed states, and all classical information which Bob2 gains are only {4\l—i\ n -\-jb}- Since 
{.^fk—i)n+j b$ anc ^ {^kb X } are completely random and independent from {0 kb X }, Bob2 cannot have any information 
about {6 Z k ' b X } from {^* 1)n+j b }. ■ 

Theorem 4 The double-server protocol satisfies (D4). 
Proof: It is easy to see that 



• When the z-rotation exp 
XZ r ^-^+^ b+1 occurs. 



-iX 
2 



'k,b + °k,b 



1 X + S X 
1 k,b + °k,b 



(k-l)n+j,b 



is implemented, the byproduct XZ r i k - 1 ) n +^ h or 
is implemented, the byproduct X r< - k ~ 1 '> n +^ b Z or 



• When the ^-rotation exp 
X r v>-v»+i.i> +1 Z occurs. 

7 i X Z I X 7 ' l ' ~X 7 1 \ 

Bob2 cannot gain any information about {r^_^ n+j b \ from {</> (fe _ 1)n+i J, since {£ (fe _ 1)n+ ^ 6 } and {5 kb } are com- 
pletely random and independent from { r ( k X i) n +j fa)' ' 

Theorem 5 The double-server protocol satisfies (D3). 

Proof: First, since {£n!* 1 \ n+ j b } are completely random, hence {t k ^ X } is independent from {f^^^j b } ■ Second, 
although e k b is related to the parity of X or Z in G k b , Bobl cannot know these parities from {e k b } since Bobl 

7 1 A" 

does not know {S k b }. Therefore (D3) is satisfied. ■ 
Theorem 6 The double-server protocol satisfies (Dl). 

Proof: From Lemma 5, Bob2 cannot send any information to Bobl. Therefore, the classical information which Bobl 
can gain arc only {e k ^ b X }- Obviously, {e^ b } arc independent from {0 kb X }. Furthermore, from Theorem 5, Bobl's 
states are one-time padded to him, therefore, no POVM on Bobl's states gives information to Bobl. ■ 



VII. DISCUSSION 



In this paper we have investigated possibilities of blind quantum computing on AKLT states, which are physically- 
motivated resource states for measurement-based quantum computation. We have shown that our blind quantum 
computation protocols can enjoy several advantages of AKLT states, such as the cooling preparation of the resource 
state, the energy-gap protection of the quantum computation, and the simple and efficient preparation of the resource 
state in linear optics with biphotons. 

We have presented two protocols, namely the single-sever protocol and the double-server protocol. In the single- 
server protocol, we have shown that blind quantum computation is possible, if Alice is allowed to have weak quantum 
technology as in the case of Ref. ||. Because AKLT resources states exhibit many different properties from those of 
the cluster state, several novel features have been introduced in our protocol compared with Ref. 0. Furthermore, 
new techniques and formalism have been required for the proof of the blindness of our protocol. 

We have also seen that in our single-server protocol, quantum computation cannot be performed in the ground space 
of a natural Hamiltonian, since if Bob does not know pre-rotated angles, he must prepare an unnatural Hamiltonian 
with exponentially-degenerated ground states. This no-go theorem is general (we do not assume the state to be the 
AKLT states), hence drastically new scheme of blind quantum computation must be required in order to perform 
blind quantum computation in the ground space of a natural Hamiltonian in the single-server setting. On the other 
hand, our double-server protocol is the first blind delegated quantum computing protocol in which Alice is completely 
classical and quantum computation is performed in the ground space of a physically-motivated Hamiltonian. 

One might think that why we have not considered the direct generalization of the double-server protocol in Ref. 0] . 
Here, the direct generalization means following protocol: Alice sends hidden angles t,} to Bobl, and Bobl creates 
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rotated AKLT states. Bobl then teleports his particles to Bob2, and Bob2 performs measurements. Let us briefly 
explain why such a direct generalization does not work for AKLT resource states. If Bobl teleports a prerotated 
particle by the operation implemented in the correlation space by Bob2's measurement can be unwanted Z 

rotation e l ^ a < bZ ^ 2 for certain teleportation error and Bob2's measurement result. In this case, Alice must compensate 
the accumulation of these unwanted rotations, and therefore she must send some number which is related to {^fj}. 
Since Bobl knows teleportation errors and {£,f ;,}> he can gain some information about Bob2's measurement results, 
and therefore Bob2 can send some classical message to Bobl. 

Although the assumption in the double-server protocol that two Bobs share no communication channel seems to 
be somehow strong, it is not far from realistic. For example, let us consider an interesting future story where many 
competing companies offer services of quantum computation (Fig. [6]). A trusted third party (D) or the client (Alice) 
herself distributes many Bell pairs among these companies, but the information of which company shares a particular 
Bell pair with another particular company is kept secret to all companies. Alice then contacts two companies of her 
choice and runs the double-server protocol by instructing both servers which Bell pair components they have to use. 
Let us assume that Alice contacts Companyl and Company2, where neither of them know with which company is 
doing the double-server protocol. Assume Companyl wants to cheat Alice, hence Companyl must call every other 
companies. However, due to the competitive nature of the market, if Companyl contacts a wrong company, say 
Company3, Company3 gains the evidence that Companyl is trying to cheat Alice, and Company3 can announce this 
fact in order to destroy the credibility of Companyl thereby removing Companyl from the market. Probably investing 
and maintaining a quantum server must be cost-expensive, hence no company wants to take the risk of being put out 
of the business. 




FIG. 6: (Color online.) D is the trusted third party which distributes Bell pairs. Two red circles connected by a red dotted 
line are qubits of a single Bell pair. 

At this stage, we do not know which quantum computation model (circuit, adiabatic, measurement-based model, 
etc.) is the most promising candidate for the realization of a scalable quantum computer. Therefore, it is valuable 
to explore possibilities of blind quantum computation in various models. It would be an interesting subject of future 
study. 
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Appendix A 

The inverse pt of the PEPS P can be implemented as follows. Bobl first prepares the two-qubit state |0) <8> |0), 
and performs the filtering operation {Fij}^'^)_, Q Q ^ on the qutrit to which he wants to apply pt and the two-qubit 
state, where 



P M = |1)(1| ® \ V3 )(iJ\ + \2)(2\ ® \ V4 )(i,j\ + |3)(3| ® 



24 



\hJ) 



\j), and 



i=Q j=Q 

With probability 1, -Fb.o is realized. Next Bobl measures the qutrit in the basis 

{-L(|l) + |2) + |3>), -L(|l) +e^/ 3 |2) + e ^ 3 |3)),-^(|l) + e^ 3 \2) +e^/ 3 |3))} 
and corrects the phase error if the result is the second or the third one. 



Appendix B 

Let E®E' G {I, A, Z, XZ} ® {I, X, Z, XZ} be the Pauli error on two qubits, and define the PEPS P by 

P = P(E® E')P f P. 

Also define the matrices {A[l], A[2], i[3]} by 



1=1 a=0 6=0 



where ^4 a ,fc[^] depends on the Pauli error as summarized in the second, third, and fourth columns of the following 
tabic. The fifth, sixth, and seventh columns are the summary of the operations implemented in the correlation space 
by the measurement Ai(<fi) after the PEPS P for each error. The eighth, nineth, and tenth columns are the summary 
of the operations implemented in the correlation space by the application of V and the measurement M(4>) after the 
PEPS P for each error. 
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Appendix C 

Protocol 6 describes how Alice performs the single-qubit x-rotation exp 
subsystem. 
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Protocol 6: Double-server Blind X rotation 

Initially the flag parameter (known to only Alice) is set t = 1. Alice sets her secret parameter e kb = and also chooses 
random numbers 8 kb G A. Alice sends Bobl parameter values N, M and n < N. Bobl creates M AKLT chains 
\AKLT b N ' L,R ), where 6=1, M (see Equation[T]) of N qutrits arranged in an array of N columns and M rows. For 
] = !,••• ,n/2, Alice, Bobl, and Bob2 repeat (I)-(VI), where the steps (I),(II)(III) are the same as in Protocol 5. 

(IV) Alice sends the angle 4>fk-i)n+j b t° Bob2. This angle is determined according to the following rule: 

• If the Pauli error is I ® I, I <g> X, X <g> I, or X ® X, 

4>?k-i)n+j,b = TSk.b + r6k,b + £(*-i) n +j,b + r fk-i) n +],bK (mod 2ir), 

where £* k _ 1 - )n+ j b € A and r/ fe _ 1 \ n+3 - i) G {0, 1} are random numbers chosen by Alice, signs of 6 kb and 5* b should 
be changed if there is the byproduct Z before this step. 

• If the Pauli error is Z ® Z, Z ® XZ, XZ ® Z, or XZ ® XZ, 

<t>(k-l)n+j,b = -T~0k,b - T5k tb - C(fc-l)n+j,6 + rfk- l)n+j,b T ( mod 2 7r), 

where £f k _ 

-i)n+j,b e A an d '"(fe-ijn+j'.b e {0> 1} are random numbers chosen by Alice. Signs of and 5 k>b should 
be changed if there is the byproduct Z before this step. 

• If the Pauli error is I ® Z, I ® XZ, X ® Z, X ® XZ, Z (Si I, Z ® X, XZ ® 7, or ® X, 

,x _ c x 

<P(k-l)n+j,b — S(fc-l)n+j',6 

where £n s _ 1 - )n+ j b € A is a random number chosen by Alice. 

(V) Bob2 applies V, does the measurement M(4>fk-i) n +j b)i an| l sends the result to Alice. By this measurement, following 
operations are implemented in the correlation space (see also Appendix |B| : 

• If the Pauli error is I ® I or X ® X, \oi{4>fk-l)n+j,b)) \P(.<t>rk-i)n+3,b))i or 1 7) occurs with the probability 1/3, 
respectively. If \a(<j>f h _ 1)n+]%h )) is realized, 

X r («-Dn+i,* +1 Zexp [ Z ^(re k i tb + rS k x , b + ^ k _ 1)n+J ^] 

is implemented. If \/3((j>(k-i)n+j,b)) ls realized, 

jT(S-i)»+,,»Zexp (re^b + rSl b + tf k - 1)n+j , b )] 

is implemented. If I7) is realized, X is implemented. 

• If the Pauli error is I®X or X®I, \ot(4>fk-i)n+i &)) or \P(4>fk-i)n+j b)) occurs with the probability 1/2, respectively. 
If \a{<t>fk-i )n+ j,b)) is realized, 

x r f^ +j , bZexp [zi* ( r ^; b + + ^_ 1)n+iii ,)] 

is implemented. If ^(^(fc-i^+j,!,)) is realized, 
is implemented. 
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Protocol 6: — Continued 

(V) — Continued 

• If the Pauli error is Z ® Z or XZ ® XZ, \&(<f>(k-i)n+j !>))> /^C^fl-— !>))> or \l) occurs with the probability 1/3, 
respectively. If \a(<j>f k _ 1)n+jjb )) is realized, 

is implemented. If \/3(4>fk-i)n+j f>)) i s realized, 

X r (£-i)-+i.»Zexp (t0& + t^ 6 + ^_ 1)n+ili ,)] 

is implemented. If I7) is realized, X is implemented. 

• If the Pauli error is Z (g> XZ or XZ ® Z, |a(0(^_i) n+Ji6 )) or |/3(<^(fc_i)„ + ^ j,)) occurs with the probability 1/2, 
respectively. If \a{4>fk-i)n+j,b)) IS realized, 

■rS-i)»+;,6Zexp (t0& + T^ 6 + $.- 1)n+i , b )] 

is implemented. If \/3(<j>fk-i)n+j,b)) i s realized, 

X r f*-i)«+^ +1 Zexp [Z^( T ^ 6 + T ^ + ^_ 1)n+ .^] 

is implemented. 

• If the Pauli error is I ® Z, X <g> XZ, Z ® 7, or XZ ® X, la^-i^+^b)}, IW(k-l)n+j,&))i or It) occurs with the 
probability \ cos 2 [i^_ 1)n+J -, ft ], \ sin 2 [±<^_ 1)ra+iii> ], or 1/2, respectively. If K<^_i )n+i , 6 )} or |/3(^_ 1)n+3 - jb )) is 
realized, X is implemented. If I7) is realized, XZ is implemented. 

• If the Pauli error is I ® XZ, X ® Z, Z <g> X, or XZ ® 7, |a(<^_i)„ +J - )fc )), IW(k-i)„+j,i>))> or I7) occurs with the 
probability | sm 2 [i05_ 1)n+Jj6 ], | cos 2 [i0$_ 1)n+j] b ], or 1/2, respectively. If \a((f>f k _ 1>+jtb )) or |/3(0(*_i )n+j)6 )) is 
realized, X is implemented. If I7} is realized, Z is implemented. 

(VI) If the x-rotation exp[=l^- (r6 kb + r5 kb + £,fk-i)n+j b )] i s implemented in the previous step, Alice sets r = 0, and e k<b = 
e k,b + £(k-i) n +j b (mod 27r) (if there is no Z byproduct before this rotation) or e k b = —£a._ 1 \ n+ j b (mod 2-7r) (if there 
is the Z byproduct before this rotation). 

(VII) So far, the x-rotation 

Gk, b exp [— ^-(e£b + <^ b )j exp [— 

up to a Pauli byproduct G kb is implemented. The probability that they fail to perform this rotation is (2/3)"^ 2 , which 
is small for sufficiently large n. Alice asks Bobl to correct the accumulated error. In order to do so she sends Bobl the 
angle e kb = e kb + 5 kb (mod 2-k) if G kb contains no Z byproduct, and e kb = — e kb — 5 kb (mod 2%) if G k b contains the 

Z byproduct. Bobl implements the rotation exp ^^j-e^(,J by using the rest of the qutrits in (fc, b)th AKLT subsystem. 

The probability that Bobl fails to perform this ^-rotation is (l/3)"^ 2 , which is small for sufficiently large n. 



